marketing-video
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies extensively on executing external binaries for media processing. Multiple scripts (audit.mjs, clips.mjs, media.mjs, mix.mjs, render.mjs) use execFileSync and spawn to run ffmpeg and ffprobe for video extraction, audio mixing, and metadata inspection. Additionally, pick.mjs executes transcription tools like whisper or mlx_whisper.\n- [DYNAMIC_EXECUTION]: The skill employs dynamic execution techniques in two main areas: scripts/takes.mjs defines a Python script as a multi-line string and executes it via a subprocess using the python -c flag to generate voice takes; scripts/render.mjs utilizes the Playwright library to launch a Chromium browser and executes JavaScript within the page context using page.evaluate() to render video frames from a GSAP animation timeline.\n- [PRIVILEGE_ESCALATION]: The setup documentation in references/setup.md provides instructions for installing system-level dependencies on Linux using sudo apt-get install -y ffmpeg, which requires administrative privileges.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external media assets and their transcriptions, creating a surface for indirect instructions to be embedded within the content.\n
- Ingestion points: Reads video files from footage/, image screenshots from shots/, and transcription text generated by whisper based on audio takes.\n
- Boundary markers: While the skill mandates a human review process and an audit step, it lacks explicit prompt delimiters or sanitization for the transcription text interpolated into the agent's context.\n
- Capability inventory: The skill has the ability to write files to the local work directory, execute shell commands via the provided scripts, and control a headless browser instance.\n
- Sanitization: No filtering or sanitization of text extracted from media transcriptions was detected.\n- [EXTERNAL_DOWNLOADS]: The documentation in references/setup.md specifies the installation of several external software packages, including playwright, chatterbox-tts, and whisper variants. The chatterbox-tts library is noted to download model weights from Hugging Face during its initial execution.
Audit Metadata